Table Of ContentZed Attack Proxy
Cookbook
Hacking tactics, techniques, and procedures for testing web
applications and APIs
Ryan Soper
Nestor N Torres
Ahmed Almoailu
BIRMINGHAM—MUMBAI
Zed Attack Proxy Cookbook
Copyright © 2023 Packt Publishing
All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted
in any form or by any means, without the prior written permission of the publisher, except in the case
of brief quotations embedded in critical articles or reviews.
Every effort has been made in the preparation of this book to ensure the accuracy of the information
presented. However, the information contained in this book is sold without warranty, either express
or implied. Neither the authors, nor Packt Publishing or its dealers and distributors, will be held liable
for any damages caused or alleged to have been caused directly or indirectly by this book.
Packt Publishing has endeavored to provide trademark information about all of the companies and
products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot
guarantee the accuracy of this information.
Associate Group Product Manager: Mohd Riyan Khan
Senior Editor: Divya Vijayan
Technical Editor: Irfa Ansari
Copy Editor: Safis Editing
Project Coordinator: Ashwin Kharwa
Proofreader: Safis Editing
Indexer: Manju Arasan
Production Designer: Prashant Ghare
Marketing Coordinator: Ankita Bhonsle and Marylou De Mello
First published: March 2023
Production reference: 1100223
Published by Packt Publishing Ltd.
Livery Place
35 Livery Street
Birmingham
B3 2PB, UK.
ISBN 978-1-80181-733-2
www.packtpub.com
A hacker is like a spider, weaving their way through the intricate webs of the internet, uncovering
secrets and breaking down barriers.
– Ryan Soper
Writing this book has been a journey akin to a trainer’s quest to conquer each gym in Pokemon. Each
chapter was a new gym leader to defeat, each obstacle a new Pokemon to train and evolve, but in the
end, it was all worth it for the ultimate victory.
– Nestor N Torres
Writing this book was an experience. When we decided to write a book at a coffee shop on a normal
Tuesday night, the idea seemed easy. A few months in and a lot of sleepless nights later, we were tired
and almost gave up on finishing the book. That is when we started to motivate and push each other so
we could make each and every deadline. I am thankful I had a great team (Nestor and Ryan) to write
a book with. Having a great team makes the impossible seem possible.
– Ahmed Almoailu
Contributors
About the authors
Ryan Soper is a lead penetration tester, senior application security engineer, and veteran of the US
Coast Guard. His experience includes penetration testing, application security, and IT consulting,
among more, throughout his career. He’s an active member and organizer of the DefCon813 chapter, a
member of the OWASP Tampa chapter, and enjoys connecting with others throughout the community
at conferences or other various networking events. He can be contacted at ryans.wapt@gmail.
com or followed on Twitter at @soapszzz.
Ryan is an ambassador for the Innocent Lives Foundation (ILF), a group of hackers that work
with law enforcement to protect children from online predators. Your support will help the team to
continue their important work. I urge you to consider making a donation to the ILF at https://
www.innocentlivesfoundation.org/donate/.
I am deeply honored to present this book to you, and I could not have done so without my family’s
unwavering love and support. My beautiful bride, Victoria, and my beloved daughter, Noelle, have been
my constant source of inspiration and motivation throughout the many late nights and long absences
required of my military and professional pursuits. Their love has been my anchor, and their presence is
a constant reminder of what truly matters in life. I am forever grateful to them and dedicate this book
to them, my soulmates.
Nestor N Torres is a senior application security engineer and web application penetration tester. His
experience includes application security, IT consulting, penetration testing, and mobile penetration
testing. He is an active member and organizer of the DefCon813 chapter and OWASP Tampa chapter,
who enjoys helping new colleagues interested in joining the cyber security field. You can find him at
his local BSides in Orlando and Tampa and other conferences such as Defcon and OWASP events.
He can be contacted at nestor.wapt@gmail.com or followed on Twitter at @n3stortorres.
I am deeply grateful to my family for supporting and encouraging me to follow my dream. I am also
thankful to the team that worked with me in Ybor City, Tampa, who played a crucial role in my cyber
security and hacking journey. These people took a chance on me, giving me my first opportunity in the
cyber security field, which opened the door to a vibrant community of like-minded individuals who have
helped shape my career. Additionally, I am forever grateful to Sunny Wear, who introduced me to the
world of web application security testing and continuously challenged me to grow and learn within the
field. Without their guidance and support, I would not have found my passion in this exciting and ever-
evolving field. My deepest gratitude for their impact on my career and this book is dedicated to them.
Ahmed Almoailu is a cyber security engineer with years of experience in vulnerability management,
risk management, network security, cloud security, and endpoint security. He has a Master of Science
in Cybersecurity and a Bachelor of Science in computer information systems from Saint Leo University
and is currently working in healthcare. He is a member of the DefCon813 chapter and participates
in security events in the community. Ahmed holds CASP+, Security+, Certified Ethical Hacker
(CEH), eJPT, and AWS Cloud Practitioner certifications. Ahmed can be contacted at ahmed.wapt@
gmail.com.
It is with the utmost gratitude and appreciation that I dedicate this book to my family. My father, Shawqi
H. Almoailu, my mother, and my sisters have been my greatest supporters and guides throughout my life.
Their trust, belief, and guidance have been invaluable to me and have helped shape the person I am today.
I am eternally grateful for the love and values they have instilled in me; without them, I would not be
where I am today. This book is a testament to their unwavering support and encouragement. Thank you.
About the reviewers
Jonathan Singer is a career cybersecurity practitioner with almost two decades of experience. In the
prior role, he secured web applications at scale in large data centers delivering hundreds of thousands
of websites and hosted services. Today, Jonathan holds a master’s degree in cybersecurity and architects
enterprise security solutions for Fortune 500 companies. You can often find him on stage at local
security conferences as a guest speaker or helping attendees as a Goon at DEF CON.
Steve Raslan is an expert Application Security Engineer and Software Developer with a ComptiaTIA
Security+ certificate and a Cyber & Network Security certificate from the prestigious Georgia Tech.
Steve comes with a multitude of years within software security architecture and design, code security
reviews & secure coding principles and is highly versed in OWASP vulnerability management and
remediation. He has a proven ability at developing micro-automation solutions that automate application
security tasks as well as providing developer-friendly cross platform application security solutions.
Disclaimer
The information within this book is intended to be used only in an ethical manner. Do not use any
information from the book if you do not have written permission from the owner of the equipment.
If you perform illegal actions, you are likely to be arrested and prosecuted to the full extent of the
law. Packt Publishing does not take any responsibility if you misuse any of the information contained
within the book. The information herein must only be used while testing environments with properly
written authorizations from the appropriate persons responsible.
Table of Contents
Preface xvii
1
Getting Started with OWASP Zed Attack Proxy 1
Downloading ZAP 2 Setting up a browser proxy and
certificate 16
Getting ready 2
How to do it... 2 Getting ready 16
Installing Docker 11 How to do it... 16
See also 11 How it works... 22
Setting up the testing environment 12 Testing the ZAP setup 22
Getting ready 12 Getting ready 22
How to do it... 12 How to do it... 22
How it works... 16 How it works... 23
There’s more... 16
2
Navigating the UI 25
Technical requirements 25 There’s more… 28
Persisting a session 26 Toolbar 28
Getting ready 26 Getting ready 28
How to do it… 26 How to do it… 28
How it works… 27 How it works… 30
Menu bar 27 See also 31
Getting ready 27 The tree window 31
How to do it… 27 Getting ready 31
How it works… 27
